Slashdot Mirror
US Has More IPv6 Eyeballs Than Asia, Because of Apple
An anonymous reader writes "Google has been checking to see who's using IPv6. According to the company's tracking, half of all IPv6-capable systems seen by Google are Macs, helping the US land in fifth place in percentage of IPv6 users world wide, ahead of China and Japan."
I don't believe any US ISPs have begun providing IPv6 connections yet, have they? So, does this statistic reflect that not only are Macs IPv6 capabable, but all of them are automatically setting up an IPv6 tunnel over their IPv4 connections? If so, what tunnel broker are they using as an endpoint (is Apple itself providing a tunnel broker service for them)?
Or, instead of using a tunnel, are they using the technology (don't remember the name, maybe 4to6?) where an IPv6 address is automatically generated from the public IPv4 address, and then IPv6 packets are sent to an IPv4 anycast address which automatically routes them to the nearest 'public' 4ot6 gateway? Unfortunately, I don't believe the latter solution works well behind NATted connections, which I think would dramatically reduce these statistics, so the sheer size of the Mac IPv6 'population' suggests to me that tunnels are being used instead?
I've recently been playing with IPv6 via Hexago Freenet6, but truth be told, there's really not much use for IPv6 yet, since very few apps (like IM clients [skype: I'm looking at you], network games, etc) or websites actually support IPv6 on the other end yet. I've also noticed a problem with packet loss and high latency with Freenet6, so I'm thinking I'm going to try to find a different tunnel broker.
not at all.
While NAT is not a be-all end-all security measure, it certainly helps, as my router provides a (stupid-basic) blank face at port-scan attempts.
Layers of defense. My router is the drawbridge of my castle.
-nB
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump
Yes; just because you can give every molecule in the solar system an IP address doesn't mean you should. There's no reason to let your home networked devices face the internet directly- it's a very bad idea to even open any ports, since you shouldn't need to. You shouldn't be providing any services to the internet from your home, even remote desktop or a network share; it's bad practice and you won't sleep well at night- it's against your ISP's terms of service anyway, if you're in America. Get a virtual server somewhere if you really need something while on the go. I'm sitting comfortably in my NAT fortress knowing everything within the physical space of my house is nmap-proof.
Yes, it has been build in into the kernel for several years now. I have IPv6 network already, works like a charm.
You need to get a ISP that supports native IPv6 or a IPv6 PoP to connect to IPv6 sites. Like http://ipv6.google.com/
LAN IPv6 is already build in, no need to configure that.
And yes, it's probably against your terms of service to offer any kind of internet services from your home without a hosting service account. That doesn't mean you can't forward ports- you can still netcat data into your network and stuff like that- but you can't provide services. Of course it's absurd and unenforcable, but it's not good to break the ToS for years at a time; play it safe.
From the article, I picked up the reason for this result (but not until after posting a similar question, I must confess). Most home computer users, regardless of their platform, tend to connect to the internet through some sort of router device. Most of these routers use IPv4 only, and use NAT to share the Internet connection.
Many Mac users, instead of using some 'generic' WiFi access point, instead use Apple's Airport Extreme router. Per the article, Airport Extreme's have support for IPv6 built right into the router, and the router will *automatically* route IPv6 traffic using the 6to4 standard (which basically tunnels the traffic over the IPv4 connection from the ISP).
I suspect that if you connected your Ubuntu computer (or Vista, or XP if you installed IPv6 manually) to the Internet using an Airport Extreme, then IPv6 would work fine under Ubuntu too. That is, I think the 'magic' here that makes IPv6 "just work" is in the router, not in the OS.
Nonsense. I've visited the homes of Mac-only users. They usually have two or three. Where things get interesting however, is that they tend to be using an Airport Router. (Which caused me no end of grief when I didn't spring to have WiFi added to my last laptop.) As someone mentioned higher up in the discussion, Airport routes IPv6 by default. Something that most other consumer routers (typically paired with Windows and Linux machines) do not.
Javascript + Nintendo DSi = DSiCade
Actually it is.
:).
The difference between a "NAT router" and a "stateful firewall with public IP stuff behind"
You need the NAT working in order to reach the stuff behind it.
You don't need the stateful stuff working in order to reach the stuff behind it.
So in event of bugs, the hacker is more likely to have to work harder to exploit the stuff behind a NAT.
Now the issue with "just NAT" is the ISP can usually access the stuff behind the NAT - just as long as they know what IP range you have behind- they just have to get IP packets with dest=your.private.ip to your NAT device and _typically_ it will pass it through (some NAT devices also have a stateful firewall so they may not pass it through).
This means a 3rd party could get past your NAT if they have control over your ISP's routers route tables. But if they achieve that control you're probably screwed anyway.
Anyway, it's good enough protection, the hackers and malware bunch hardly do direct network attacks anymore against Joe User, much easier to convince Joe User to run stuff
That's not a false negative, that's you misunderstanding the test. They are testing users who are actually IPv6 enabled, not just users running IPv6 capable hardware.
-- The act of censorship is always worse than whatever is being censored. Always.
IPv6 is enabled on all OS X installs as the default. Few, if any, users -either at home or in a corporate setting- turn it off. At my site, IPv6 is not enabled on the network so all Macs have it disabled in all system images.
Sig this!
> Without a NAT, how does a "NoNAT router" know what public IP range to give via DHCP (or other means) to Joe User's WinXP/Mac box, BEFORE it manages to get that public IP range from the ISP?
Before it connects to the ISP you'll be using link-local addresses. The router will then get a prefix from the ISP via DHCP prefix delegation and begin sending router advertisements so internal computers can configure themselves with public addresses (though they retain their link-local addresses).
I rarely criticize things I don't care about.
I doubt it's really not allowed where I live (not in USA though), and the first three months I had only plugged in the TP-cable without signing any paper or anything. No login required, just plug the machine in and voila Internet with DHCP.
You do realize it will take months to map a LAN with IPv6 through nmap ? Because the IPv6-address space for the LAN is bigger then the whole IPv4-internet.
New things are always on the horizon
This may be the answer
Apple's secret "Back to My Mac" push behind IPv6
http://www.appleinsider.com/articles/08/08/19/apples_secret_back_to_my_mac_push_behind_ipv6.html
What the hell are you talking about? You're using link-locals till the route gets a real IP, then it advertises the new route, the clients get new IPs and everything functions just as normal the whole time.
And the URL Joe Public types in is the same as now. "http://name.your.router", supplied by the manual, provided by the DNS server in the router, the same as he does now. You don't think he types in cryptic ip adresses, do you?
I think the future means every single device having a IP, perhaps even human beings if you are paranoid. :)
Don't think about today, think about the future. Can you imagine every cell phone user somehow browses the net and plays some games?
It is not like today's concept, it is about the very weird and connected future. I agree demanding IPV6 from a consumer level ISP today is a bit overkill but recently my heater company called me and asked if I wanted my combination heater (Vaillant) to be connected to net. I asked if it is Windows some sort, they said "yes" and I said "good luck with that".
BUT before Joe's router is connected to the ISP, how does his router or PC know what address they should be using?
This is actually a topic of debate on IPv6 lists right now. There are basically two camps: One says that Joe's router should give out unique local addresses, the other says that a LAN only needs link locals. Both sides are, as far as I can tell, supporting their stance with really good arguments.
Joe would not have to wait for "dhcp renewal time" seconds, or "some other public IP update period" seconds, before his PC realizes that "Oh I'm supposed to be using this public IP address and this gateway".
That's not how IPv6 works. Joe's computer gets a Router Advertisement message as soon as the Internet LED lights up and everything instantly works.
Like most criticism of IPv6 on Slashdot, your criticism is founded on ignorance.
Finally! A year of moderation! Ready for 2019?
That's exactly right. To get IPv6 working on my system at home, I just set up the router. My Powerbook, my Ubuntu machines, and my wife's Windows Vista machine, all automatically picked up IPv6 and can all connect to http://ipv6.google.com/
For those rolling their own router boxes, you can see what I did here (caution - it's my blog and this is a tag that brings up a bunch of articles, start reading at the bottom...) I used 6to4 as well. It's worth getting a static IP address if you plan to use 6to4, and it's also worth noting that some ISPs, notable BellSouth/AT&T FastAccess, actually block use of 6to4, for reasons I don't really understand. Before wasting any time on it, try to ping 192.88.99.1 from a machine directly connected to the Internet. If you get responses, you can do 6to4. If you don't, you're going to have to try one of the IPv6 tunnel brokers, which is a supremely inefficient way of doing everything and makes you dependent upon the goodwill of a third party.
You are not alone. This is not normal. None of this is normal.
IPv6 is available via 6to4 on IPv4 connections, or if your ISP really does block it (rather than just not support it), you can also try a tunnel broker.
The big advantage of the Apple set up is that their Airport routers have 6to4 support built-in. (The article is a little confusing, it's Apple's routers that are providing the advantage, not their desktops.)
You are not alone. This is not normal. None of this is normal.
I don't think you understand how a default IPv6 set up works and I don't think the guy who's insulting you is being terribly helpful.
With IPv6, you get a huge block of addresses (as high as 2^80, approximately, though 2^64 is generally what people actually use and is often the limit for tunnel broker negotiated links) allocated to each network (that is, if your router is responsible for connecting to the Internet, then right now when it connects it gets 1 IPv4 address. But if it supports IPv6, it'll get, via 6to4 or a tunnel broker or a PPP-negotiated setup, a BLOCK of between 2^64 and 2^80 addresses. It can grab any of these for itself.)
That's your home network with all those IPv6 addresses. Your router accepts configuration requests by prepending the network prefix (the first 48 or 64 bits of your network's address) to a mangled version of the client's MAC address. It can then talk to the outside world. It has a globally routeable address. Any traffic with the first 48 bits of your client's IPv6 address will be routed to your router, and your router will send it to the client machine.
It's actually SIMPLER than your average NAT+DHCP router.
This isn't theory BTW, this is what I use at home. I have a bog-standard Earthlink DSL connection. Earthlink doesn't currently support IPv6. It doesn't do anything other than route IPv4 packets. The only block is does is on outgoing port 25 connections. That's it. It's your basic ISP.
My router understands 6to4 (I built it myself.) It turns the IPv4 address I get from Earthlink into a 6to4 network block. It tells every computer on my network what that computer's IPv6 address(es - yeah, more than one is allowed) are and that it does all the routing. Those addresses are static. They are ALL globally routeable, that is, they're real IP addresses, not equivalents of 10.x.x.x. My firewall set-up decides which machines should be allowed to receive incoming connections from the outside world. I have forward and reverse DNS set up for the IPv6 addresses.
My Powerbook, Ubuntu Desktop, Ubuntu Thinkpad, Ubuntu VMs, and my wife's Vista machine are all connected and do not have any problems using it, and they "just worked" - I didn't have to configure them. I've noticed the Wii has an address but doesn't use it. My Dish Network box and HD DVD player do not ask for IPv6 addresses, so aren't routeable (though they do the IPv4 thing with NAT and 10.x.x.x.), my Nokia N800 also doesn't have any inbuilt IPv6 support though it's apparently a third party firmware update away from doing so.
This is what the situation is now. It's a working system. It doesn't use DHCPD, it uses RADVD. The router has lots of IPv6 addresses, it knows how to give them out, and the computers on my network that know IPv6 can get those addresses.
Does that help?
You are not alone. This is not normal. None of this is normal.
Unless you are looking at a fairly strange cross-section of consumer routers, most of them do not run Linux. Only a handful of the ones offered by Linksys, D-Link, etc. do. The majority run VxWorks, I believe.
A few years back there were actually more Linux-based routers but as cost pressures and competition have increased the manufacturers seem to have moved away in order to reduce the parts count. Broadband routers are the only pieces of equipment I've seen where the hardware specs have actually fallen, year over year, for comparable pieces of gear.
Anyway, if you do happen to get a real Linux router (like the Linksys WRT54GL, or early *G editions) and reflash the firmware to DD-WRT, you can enable IPv6. I don't think it does automatic 6to4 (at least it doesn't in the version I'm running) so it's not quite as slick as the Apple routers, but the capability is definitely there if you're running a decent load of software. I don't know if the capability is actually been removed from the kernel in stock firmwares or just not enabled.
I don't know what VxWorks' support for v6 is like, so I'm not sure how trivial it is for manufacturers to enable it, if they wanted to.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
FYI, for those running routers that can run DD-WRT:
http://www.dd-wrt.com/wiki/index.php/IPv6#6to4_Setup
What are we going to do tonight Brain?
Doesn't matter if your router supports IPv6 if your ISP does not.
Sure it does. The whole point, and what makes it so cool, is that the AirPort sets up 6-to-4 tunnelling automatically. So you *can* have IPv6 connectivity even if your ISP doesn't provide it.
noah